Analysis

  • max time kernel
    133s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 22:09

General

  • Target

    c18d9a1d8bd404a2cec184a98a607bca2b53b6ca0e42f9881e10ee2ad0fe485c.xlsm

  • Size

    20KB

  • MD5

    34125f9a3baf4f4f6de297b12e77c947

  • SHA1

    dac702750e14931d525d6610c4ab527a3098dbb7

  • SHA256

    c18d9a1d8bd404a2cec184a98a607bca2b53b6ca0e42f9881e10ee2ad0fe485c

  • SHA512

    6fe06bfd5d8fc088e732f6f9ae4892c288b1467731ae17a21bc36a4483623daf55c9e2f922747f51499fa70b28d86f277fa87aebb961be16406cc678850e6e31

  • SSDEEP

    384:mQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:mTINqTo4FL3CBn9kC+xbLHjj

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.bridgewien.at/admin/9Osvbo9caA4QYishnWka/

xlm40.dropper

http://bartboutens.nl/cgi-bin/aPqSkCZXI3ueRdI/

xlm40.dropper

http://aleph.org.ng/wp-includes/k8YwVWkrdmUM9/

xlm40.dropper

http://alkautsarlampung.sch.id/belajar/WQlNleMJKoulGBUvgC9/

xlm40.dropper

http://automyjniafordon.bydgoszcz.pl/123/mOWZgMaL/

xlm40.dropper

http://www.annuncisiciliani.it/app/3l1ZgVfwIEiIcGelh/

xlm40.dropper

http://autoat.mx/assets/VljikBuT029PkSBfrc/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c18d9a1d8bd404a2cec184a98a607bca2b53b6ca0e42f9881e10ee2ad0fe485c.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    9a1a5b0506e4a4a343b007bc48d445ae

    SHA1

    f3c748d4ab3882bf750470798cf33d3ec107b16b

    SHA256

    2a01b4999d646f982632925016eb4d77126bd024ee0beef6bf2e8a4e36adcc77

    SHA512

    2194e7e757fd183a8011c701d57c9add5b129d217d3a27b9b5e7bac61c02bc93cdcb525a1967aae3bca1a4981d64247d88edfedacfc38f7144973a188b5d3020

  • memory/3304-19-0x00007FFB01C50000-0x00007FFB01C60000-memory.dmp

    Filesize

    64KB

  • memory/3304-45-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-5-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

    Filesize

    64KB

  • memory/3304-0-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

    Filesize

    64KB

  • memory/3304-1-0x00007FFB43F2D000-0x00007FFB43F2E000-memory.dmp

    Filesize

    4KB

  • memory/3304-9-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-11-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-12-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-16-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-17-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-2-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

    Filesize

    64KB

  • memory/3304-4-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

    Filesize

    64KB

  • memory/3304-13-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-14-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-15-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-10-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-8-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-7-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-6-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-42-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-44-0x00007FFB43F2D000-0x00007FFB43F2E000-memory.dmp

    Filesize

    4KB

  • memory/3304-3-0x00007FFB03F10000-0x00007FFB03F20000-memory.dmp

    Filesize

    64KB

  • memory/3304-49-0x00007FFB43E90000-0x00007FFB44085000-memory.dmp

    Filesize

    2.0MB

  • memory/3304-18-0x00007FFB01C50000-0x00007FFB01C60000-memory.dmp

    Filesize

    64KB